Are you sure it's source of current kar format?

I founded some differences in header. Here is right:
void readExternal(DataInput in)
throws IOException, ClassNotFoundException
{
in.readByte(); // not known, not present in default
if(in.readBoolean())
password = in.readUTF();
timestamp = in.readLong();
in.readByte(); // not known, not present in default
String deflatet = in.readUTF(); // was byte
deflate = Integer.parseInt(deflatet.substring(deflatet.index Of("=") + 1, deflatet.length() - 1)) <= 0 ? false : true;
One more interesting thing:
password digest stored in kar(password = in.readUTF() has 29 symbols "8612427997cc3b484346c73f11bba", but must be 32, coz it's md5.

Password do not match if nothing changed, password need to decrypt files. For headers is no need.

Some files from image.kar:
/arena/cg_loadingstg1_poyeen05.png
/arena/cg_room1img_a00_01.png
/mate/cg_mate2_B_angry.png
/arena/cg_loadingstg1_black02.png
/arena/cg_loadingstg1_event004.png
/other/ic_planet_flowy.png
/loading/loading_001.png